[openssl/openssl] 8e472b: crypto/x509/pcy_cache.c: fix ext_pcons leak in pol...
"'007bsd' via openssl-commits" <[email protected]>
| Newsgroups | gmane.comp.encryption.openssl.cvs |
|---|---|
| Message-ID | <openssl/openssl/push/refs/heads/openssl-3.4/[email protected]> |
Branch: refs/heads/openssl-3.4
Home: https://github.com/openssl/openssl
Commit: 8e472b1fab3556bbb0d9ef6c6cd58a61f0d05980
https://github.com/openssl/openssl/commit/8e472b1fab3556bbb0d9ef6c6cd58a61f0d05980
Author: 007bsd <[email protected]>
Date: 2026-06-26 (Fri, 26 Jun 2026)
Changed paths:
M crypto/x509/pcy_cache.c
Log Message:
-----------
crypto/x509/pcy_cache.c: fix ext_pcons leak in policy_cache_new()
Two early-return paths in policy_cache_new() bypass the just_cleanup:
label and leak the POLICY_CONSTRAINTS object ext_pcons: (1) when
certificatePolicies is absent but policyConstraints is present, and
(2) when policy_cache_create() returns <= 0. Free ext_pcons before
each early return.
Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial
Fixes: 4acc3e907d29 "Initial support for certificate policy checking and evaluation."
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
MergeDate: Fri Jun 26 15:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/31678)
(cherry picked from commit 1f5a44a66df44751d999fc90751ce098975f18a6)
To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications
--
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.4/375f37-8e472b%40github.com.